ZAP Scanning Report

About this report

No contexts were selected, so all contexts were included by default.

The following sites were included:

(If no sites were selected, all sites were included by default.)

An included site must also be within one of the included contexts for its data to be included in the report.

Included: High, Medium, Low, Informational

Excluded: None

Included: User Confirmed, High, Medium, Low

Excluded: User Confirmed, High, Medium, Low, False Positive

This table shows the number of alerts for each level of risk and confidence included in the report.

(The percentages in brackets represent the count as a percentage of the total number of alerts included in the report, rounded to one decimal place.)
		User Confirmed	High	Medium	Low	Total
		Confidence
Risk	High	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)
	Medium	0 (0.0%)	0 (0.0%)	2 (6.7%)	0 (0.0%)	2 (6.7%)
	Low	0 (0.0%)	0 (0.0%)	0 (0.0%)	24 (80.0%)	24 (80.0%)
	Informational	0 (0.0%)	0 (0.0%)	0 (0.0%)	4 (13.3%)	4 (13.3%)
	Total	0 (0.0%)	0 (0.0%)	2 (6.7%)	28 (93.3%)	30 (100%)

This table shows, for each site for which one or more alerts were raised, the number of alerts raised at each risk level.

Alerts with a confidence level of "False Positive" have been excluded from these counts.

(The numbers in brackets are the number of alerts raised for the site at or above that risk level.)
		High (= High)	Medium (>= Medium)	Low (>= Low)	Informational (>= Informational)
		Risk
Site	https://rezijiser.herokuapp.com	0 (0)	0 (0)	12 (12)	2 (14)
Site	http://rezijiser.herokuapp.com	0 (0)	2 (2)	12 (14)	2 (16)

This table shows the number of alerts of each alert type, together with the alert type's risk level.

(The percentages in brackets represent each count as a percentage, rounded to one decimal place, of the total number of alerts included in this report.)
Alert type	Risk	Count
Weak Authentication Method	Medium	2 (6.7%)
Timestamp Disclosure - Unix	Low	24 (80.0%)
Information Disclosure - Suspicious Comments	Informational	4 (13.3%)
Total		30

GET http://rezijiser.herokuapp.com/robots.txt

Alert description	HTTP basic or digest authentication has been used over an unsecured connection. The credentials can be read and then reused by someone with access to the network.
Request	Request line and header section (224 bytes) `GET http://rezijiser.herokuapp.com/robots.txt HTTP/1.1 Host: rezijiser.herokuapp.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 Pragma: no-cache Cache-Control: no-cache` Request body (0 bytes)
Response	Status line and header section (451 bytes) `HTTP/1.1 401 Server: Cowboy Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Www-Authenticate: Basic realm="Realm" X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Type: application/json Date: Fri, 04 Feb 2022 00:55:10 GMT Via: 1.1 vegur` Response body (102 bytes) `{"timestamp":"2022-02-04T00:55:11.276+00:00","status":401,"error":"Unauthorized","path":"/robots.txt"}`
Evidence	`WWW-Authenticate: Basic realm="Realm"`
Solution	Protect the connection using HTTPS or use a stronger authentication mechanism

GET http://rezijiser.herokuapp.com/sitemap.xml

Alert description	HTTP basic or digest authentication has been used over an unsecured connection. The credentials can be read and then reused by someone with access to the network.
Request	Request line and header section (225 bytes) `GET http://rezijiser.herokuapp.com/sitemap.xml HTTP/1.1 Host: rezijiser.herokuapp.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 Pragma: no-cache Cache-Control: no-cache` Request body (0 bytes)
Response	Status line and header section (451 bytes) `HTTP/1.1 401 Server: Cowboy Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Www-Authenticate: Basic realm="Realm" X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Type: application/json Date: Fri, 04 Feb 2022 00:55:11 GMT Via: 1.1 vegur` Response body (103 bytes) `{"timestamp":"2022-02-04T00:55:11.493+00:00","status":401,"error":"Unauthorized","path":"/sitemap.xml"}`
Evidence	`WWW-Authenticate: Basic realm="Realm"`
Solution	Protect the connection using HTTPS or use a stronger authentication mechanism